CLI overview

Every top-level grith command, the five global flags, and the two aliases that are not in --help.

grith is one binary. The first positional argument is the command; with no arguments it drops into the interactive REPL.

grith <command> [options...]

The 18 commands

Command	What it does
`run`	Execute a single task non-interactively
`exec`	Supervise an external CLI tool with OS-level syscall interception
`proxy test`	Dry-run a tool call through the filter pipeline
`digest`	Review the quarantine queue
`audit`	Browse, export, compact and rebuild from the audit log
`log`	Human-readable feed of decisions, live or historic
`canary`	Manage canary tokens for exfiltration trap detection
`supervisor`	List or manage active supervisor sessions
`daemon`	Start, stop and pair the daemon and its dashboard
`profile audit`	Audit a recorded syscall trace against a profile
`reputation`	Inspect or reset the learned trust table
`notifications`	Notification channel status
`config`	Print the effective configuration, or set one key
`init`	Write a default `config.toml`
`setup`	Run the interactive first-run setup
`pro`	Sign in, activate a licence, pull team policy
`analytics`	Cloud analytics sync for this machine
`completions`	Print a shell completion script

proxy and profile each have exactly one subcommand, shown above. help also exists, and prints the help for any command.

Every one of these works on every subcommand.

Flag	What it does
`--config <path>`	Merge this file over the usual layers as one more layer. It does not replace them, and `GRITH_*` variables are still applied after it.
`--log-level <level>`	`trace`, `debug`, `info`, `warn` or `error`. This is the only CLI flag that is a configuration layer, and it is applied last.
`--no-color`	Drop ANSI colour. Use it when piping.
`--project <name>`	Override the project name, which otherwise comes from the current directory.
`--skip-onboarding`	Skip the first-run setup. Also `GRITH_SKIP_ONBOARDING=1`.

The command is grith daemon. Most of the daemon's own output still says grith dashboard; both spellings work, so paste whichever it hands you.

Commands exit 0 on success and 1 on failure. Two exceptions:

grith proxy test exits 0 for allow, 1 for queue, 2 for deny.
grith analytics verify-archives exits non-zero when an archived day does not match, which is the whole point of running it.

An invalid argument is a clap usage error and exits 2.